Skip to content

Commit

Permalink
OS-1126 NTP Service Can Stall "Setup Reboot" by 30 Minutes
Browse files Browse the repository at this point in the history
  • Loading branch information
Keith M Wesolowski committed Oct 22, 2012
1 parent 11554d9 commit ba8bed2
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions ntp/Solaris/ntp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,34 @@ if [ ! -f /etc/inet/ntp.conf ]; then
exit $SMF_EXIT_ERR_CONFIG
fi

#
# If there are any servers or peers configured, we must be able to reach
# at least one of them. If we cannot, the daemon will hang before daemonising,
# and the service will be wedged. This static check is obviously incomplete,
# as nothing precludes this condition from arising after we check it. But it
# does catch the overwhelmingly common case, in which we are executing on a
# machine that simply has no access to any of its (presumably non-local)
# servers.
#
need_host_check=
host_ok=
while read; do
set -- $REPLY
if [[ "$1" != "peer" ]] && [[ "$1" != "server" ]]; then
continue
fi
need_host_check=yes
if ping -- "$2" >/dev/null 2>/dev/null; then

This comment has been minimized.

Sign in to view

Copy link
@aglarond

aglarond Mar 22, 2013

Can we change "ping" to "ntpdate"?

There are two reasons for this:

  1. restrictive firewalls may allow UDP/TCP traffic to port 123, but block ICMP
  2. a greatly skewed initial clock will automatically be set to a value ntpd can more easily work with

We actually have multiple networks where the first issue is relevant. The second is a nice-to-have that would save an extra step in server initialization.

This comment has been minimized.

Sign in to view

Copy link
@aglarond

aglarond Mar 25, 2013

Glad to hear about OS-1972. What exactly does it address?

  1. I'll not contest the brokenness of the firewall configurations, and/or the semantics of interpreting "host" in the RFC, but that is out of my hands. I can only try to argue (again) for allowing ICMP Echo Requests/Replies...

  2. OK, I'll check if there's anything in the newest release, and if not, open a bug report.

  3. Given the statement that NTP software changes slowly, wouldn't 'ntpdate -uq' be a valid workaround, with perhaps an executable check to see if the program still exists? By the time ntpdate is removed, one would hope that ntpd does the right thing.
host_ok=yes
break;
fi
done < /etc/inet/ntp.conf

if [[ -n "$need_host_check" ]] && [[ -z "$host_ok" ]]; then
echo "Error: Servers/peers specified but none is reachable."
exit $SMF_EXIT_ERR_CONFIG
fi

# Disable globbing to prevent privilege escalations by users authorized
# to set property values for the NTP service.
set -f
Expand Down

0 comments on commit ba8bed2

Please sign in to comment.